At the moment, the ssl icon more or less shows up when the throbber ends spinning. This is very much later than when we know the connection is secure (since we know that after the SSL connection started, before even sending the first request). Although, I don't know what fennec displays for secure pages with insecure content, which might lead to some confusion.
We check the identity of the connection in onSecurityChange: http://mxr.mozilla.org/mozilla-central/source/mobile/android/chrome/content/browser.js#3558 This was ported over from desktop, so changing this probably involves a more general platform change, especially considering we get the identity data from the XUL browser element.
You need to log in before you can comment on or make changes to this bug.